Operating a global, real-time platform at Uber's scale requires infrastructure that is both resilient and cost-efficient. Historically, reliability was ensured through a costly 2x capacity model--each service provisioned to handle global traffic independently across two regions--leaving half the fleet idle. We present Uber's Failover Architecture (UFA), which replaces the uniform 2x model with a differentiated architecture aligned to business criticality. Critical services retain failover guarantees, while non-critical services opportunistically use failover buffer capacity reserved for critical services during steady state. During rare "full-peak" failovers, non-critical services are selectively preempted and rapidly restored, with differentiated Service-Level Agreements (SLAs) using on-demand capacity. Automated safeguards, including dependency analysis and regression gates, ensure critical services continue to function even while non-critical services are unavailable. The quantitative impact is significant: UFA reduces steady-state provisioning from 2x to 1.3x, raising utilization from ~20% to ~30% while sustaining 99.97% availability. To date, UFA has hardened over 4,000 unsafe dependencies, eliminated over one million CPU cores from a baseline of about four million cores.

翻译：在Uber的规模上运营全球实时平台，需要兼具弹性与成本效益的基础设施。历史上，可靠性是通过昂贵的2倍容量模型来保证的——每个服务在两个区域独立配置以处理全球流量——这导致一半的机群处于闲置状态。我们提出了Uber故障切换架构（UFA），它用与业务关键性相匹配的差异化架构取代了统一的2倍模型。关键服务保留故障切换保证，而非关键服务在稳态期间则有机会使用为关键服务预留的故障切换缓冲容量。在罕见的"全峰值"故障切换期间，非关键服务会被选择性地抢占并利用按需容量通过差异化的服务级别协议（SLA）快速恢复。包括依赖关系分析和回归门在内的自动化保障机制，确保即使非关键服务不可用，关键服务也能持续运行。其量化影响显著：UFA将稳态资源配置从2倍减少到1.3倍，利用率从约20%提升至约30%，同时维持了99.97%的可用性。迄今为止，UFA已加固了超过4000个不安全的依赖关系，并从约四百万个CPU核心的基线中消除了超过一百万个CPU核心。